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< Sir: 

Prior to examination of the above-identified national phase application, please 
amend the application as follows: 



IN THE CLAIMS 

Please amend claims 19 and 26 and add new claims 31 and 32 as follows: 
At claim 19, line 1, replace "14, or 15" with —14—. 
At claim 26, line 1, replace "21, or 22" witii -21-. 



-31. The random function generating method of claim 15, wherein said candidate 
functions are each to a composite function composed of at least one function resistant 
to said differential cryptanalysis and said linear ciyptanalysis and at least one function 
of an algebraic structure different from that of said at least one function. 
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-32. The recording medium of claim 22, wherein said candidate functions are each a 
composite function composed of at least one function resistant to said differential 
cryptanalysis and said linear cryptanalysis and at least one function of an algebraic 
strucmre different from that of said at least one function. 



Claims 1-32 remam in the application. By the foregoing amendment, claims 19 
and 26 were amended to eliminate improper multiple dependencies. New claims 31 
and 32 are the recitations of claims 19 and 26, respectively, which were eliminated by 
the foregoing amendment. These changes are not believed to introduce new matter, 
and entry of this amendment is respectfully requested. 
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No. 22-0185. 
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THEREON PROGRAMS FOR IMPLEMENTING THE METHODS 
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TECHNICAL FIELD 

The present invention relates to an apparatus and method which are 
applied, for example, to a cryptographic device to evaluate whether 
candidate functions satisfy several randomness criteria so as to obtain a 
10 function that generates an irregular output from the input and hence make 
the analysis of its operation difficult; the invention also pertains to an 
apparatus and method for generating a random function evaluated to satisfy 
the randomness criteria, and a recording medium having recorded thereon 
programs for implementing these methods. 

15 

PRIOR ART 

Encryption techniques are effective in concealing data. Encryption 
schemes fall into a secret-key cryptosystem and a public-key cryptosystem. 
In general, the public-key cryptosystem is more advanced in the research of 
20 security proving techniques than secret-key cryptosystem, and hence it can 
be used with the limit of security in mind. On the other hand, since no 
security proving techniques have been established for the secret-key 
cryptosystem, it is necessary to individually deal with cipher attacks when 
they are found. 

25 To construct fast and secure secret-key cryptography, there has been 

proposed a block cipher scheme that divides data into blocks of a suitable 
length and enciphers each block. Usually, the block cipher is made secure 
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by applying a cryptographically not so strong function to the plaintext a 
plurality of times. The cryptographically not so strong function is called an 
F-function. 

It is customary in the art to use, as an element of the F-function, a 
5 random function, called an S-box, which generates an irregular output from 
the input thereto, making it difficult to analyze its operation. With the S- 
box that has the random function capability of providing a unique 
input/output relationship, it is possible to achieve constant and fast output 
generation irrespective of the complexity of the random function operation 

10 itself, by constructing the S-box with a ROM that has the input/output 
relationship as a table. Since the S-box was adopted typically in DES 
(Data Encryption Standard), its security and design strategy have been 
studied. Conventionally, the security criterion assumed in the 
implementation of the S-box is only such that each bit of encrypted data, for 

15 instance, would be a 0 or 1 with a statistical probability of 50 percent — ^this 
is insufficient as the theoretical criterion for the security of block ciphers. 

In actual fact, cryptanalysis methods for block ciphers that meet the 
above-mentioned criterion have been proposed: a differential cryptanalysis 
in literature "E. Biham, A. Shamir, 'Differential Cryptanalysis of DES-like 

20 cryptosystems,' Journal of Cryptology, Vol. 4, No. 1, pp.3-72" and a linear 
cryptanalysis in literature "M. Matsui, 'Linear Cryptanalysis Method for 
DES Ciphers,' Advances in Cryptology-EUROCRYPT' 93 (Lecture Notes 
in Computer Science 765), pp.386-397. Springer- Verlag, 1994." It has 
been found that many block ciphers can be cryptanalyzed by these methods; 

25 hence, it is now necessary to review the criteria for security. 

After the proposal of the differential and linear cryptanalysis 
methods the block ciphers have been required to be secure against them. 
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To meet the requirement, there have been proposed, as measures indicating 
the security against the cryptanalysis methods, a maximum average 
differential probability and a maximum average linear probability in 
literature "M. Matsui, 'New Structure of Block Ciphers with Provable 
5 Security against Differential and Linear Cryptanalysis,' D. GoUmann, editor, 
Fast Software Encryption, Third International Workshop, Cambridge, UK, 
February 1996, Proceedings, Vol. 1039 of Lecture Notes in Computer 
Science, pp. 205-218, Springer- Verlag, Berlin, Heidelberg, New York, 
1996." It is indicated that the smaller the measures, the higher the security 

10 against the respective cryptanalysis. 

Moreover, it has recently been pointed out that even ciphers secure 
against the differential and the linear cryptanalysis are cryptanalyzed by 
other cryptanalysis methods, and consequently, the criterion for security 
needs a further reappraisal. More specifically, in literature "T. Jackson, L. 

15 R. Knudsen, 'The Interpolation Attack on Block Ciphers,' Fast Software 
Encryption Workshop (FSE4) (Lecture Notes in Computer Science 1276), 
pp. 28-40, Springer- Verlag, 1997," it is described that some ciphers, even if 
secure against the differential and the linear cryptanalysis, are cryptanalyzed 
by a higher order differential attack or interpolation attack. 

20 Other than the higher order differential attack and interpolation 

attack, a partitioning cryptanalysis generalized from the linear cryptanalysis 
is introduced in literature "C. Harpes, J. L. Massey, 'Partitioning 
Cryptanalysis, 'Fast Software Encryption Workshop (FSE4) (Lecture Notes 
in Computer Science 1267), pp. 13-27, Springer- Verlag, 1997," and hence it 

25 is necessary to provide ciphers with sufficient security against this 
cryptanalysis. 

The technology to ensure the security against the differential and the 
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linear cryptanalysis has been established for the construction of some block 
ciphers, while as of this point in time no technology has been established yet 
which guarantees perfect security against the higher order differential attack, 
the interpolation attack and the partitioning attack. In other words, there 
5 have not been clarified necessary and sufficient conditions that random 
functions, i.e. the so-called S-boxes, need to satisfy so as to make ciphers 
invulnerable to these attacks. 

In designing the S-boxes it is an important issue to provide sufficient 
security against these attacks. The attacks on the S-boxes utilize any 

10 imbalances in their input/output relationships. Accordingly, to design an S- 
box resistant to an attack is to design an S-box that has little unbalanced, 
that is, random input/output relationship. Hence, to evaluate the resistance 
of the S-box to an attack is equivalent to the evaluation of its randomness. 

It is therefore an object of the present invention to provide a function 

15 randomness evaluating apparatus and method which find out a criterion 

closely related to the level of security against each of the above-mentioned 
attacks, the criterion representing a necessary condition to be met for 
providing the resistance to the attack (not a necessary and sufficient 
condition for guaranteeing the security against the attack), and evaluate the 

20 randomness of the function concerned according to the criterion, and a 
recording medium having recorded thereon the method as a program. 
Another object of the present invention is to provide an apparatus and 
method for generating a random function that satisfies the security criterion, 
and a recording medium having recorded thereon the method as a program. 

25 

DISCLOSURE OF THE INVENTION 

The function randomness evaluating apparatus and method 
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according to the present invention execute at least one of the processes of: 

calculating the minimum value of the degree of a Boolean 
polynomial regarding the input by which each output bit of the function to 
be evaluated is expressed, and evaluating the resistance of the function to 
5 higher order differential cryptanalysis accordhigly; 

when fixing a key y and letting x denote the input, expressmg an 
output y by y = 4(x) using a polynomial over the Galois field which is 
composed of elements equal to a prime p or a power of the prime p, then 
calculating the number of terms of the polynomial, and evaluating the 
10 resistance of the function to interpolation cryptanalysis accordingly; 

dividing all inputs of the function to be evaluated and the 
corresponding outputs into input subsets and output subsets, then calculating 
an imbalance of the relationship between the subset of an input and the 
subset of the corresponding output with respect to their average 
15 corresponding relationship, and evaluating the resistance of the function to 
partitioning cryptanalysis accordingly; and 

calculating, for every set of input difference Ax and output mask 
value r y of the function S(x) to be evaluated, the number of inputs x for 
which the inner product of (S(x)+S(x Ax)) and the output mask value Ty is 
20 1, and evaluating the resistance of the function to differential-linear 
cryptanalysis accordingly . 

The random function generating apparatus and method according to 
the present invention generate candidate functions each formed by a 
plurality of functions of different algebraic structures and having a plurality 
25 of parameters, evaluates the resistance of each candidate function to 
cryptanalysis, and select candidate functions of higher resistance to the 
cryptanalysis. 
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BRIEF DESCRIPTION OF THE DRAWINGS 

Fig. 1 is a block diagram illustrating an example of the functional 
configuration of each of the random function generating apparatus and the 
function randomness evaluating apparatus according to the present 
5 invention. 

Fig. 2 is a block diagram depicting an example of the basic 
configuration of the random function generating apparatus according to the 
present invention. 

Fig. 3 is a flowchart showing an example of a procedure of an 
10 embodiment of the random function generating apparatus according to the 
present invention. 



BEST MODE EOF CARRYING OUT THE INVENTION 
Embodiment according to a first aspect of the present invention 

15 In Fig. 1 there is depicted the functional configuration of an 

embodiment of each of the random function generating apparatus and the 
function randonmess evaluating apparatus according to the present invention. 
An input part 11 inputs therethrough data and a parameter that are needed to 
generate a candidate function in a candidate function generating part 12. 

20 The candidate function generating part 2 generates a candidate function 
based on the input provided through the input part 11, and provides its 
parameter value, the input value and the calculation result (an output value) 
to a storage part 13. Various pieces of data thus stored in the storage part 
13 are read out therefrom and fed to a differential-cryptanalysis resistance 

25 evaluating part 14a, a linear-cryptanalysis resistance evaluating part 14b, a 
higher-order-differential-attack resistance evaluating part 14c, an 
interpolation-attack resistance evaluating part 14d, a partitioning-attack 
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resistance evaluating part 14e, a differential-linear-attack resistance 
evaluating part 14f, and a criteria evaluating part 14g for evaluating other 
criteria. Based on the results of evaluations made in the respective 
evaluating parts, candidate functions of high resistance to the attacks are 
5 selected in a function select part 15 and stored in a storage part 16, from 
which a required one of the candidate functions is read out and provided to 
the outside via an output part 17. 

In the function randomness evaluating apparatus according to the 
present invention, the functions to be evaluated are provided via the input 

1 0 part 11 to the respective evaluating parts 14a to 14g for the evaluation of 
their randomness. 

A description will be given below of security criteria for the 
differential cryptanalysis, the linear cryptanalysis, the higher order 
differential attack, the interpolation attack, the partitioning attack and the 

1 5 differential-linear attack and of necessary conditions for the security criteria 
to have resistance to the respective attacks. In the following description, 
let n and m be arbitrary natural numbers and consider, as the S-box (a 
random function), a function S of an n-bit input and an m-bit output: 
GF(2)" GF(2)"'. GF(2)" represents a set of all n-bit data. 

20 (a) Necessary Condition for Resistance to Differential Cryptanalysis 
A description will be given below of a criterion for differential 
cryptanalysis is defined as a measure of the resistance thereto of the S-box, a 
method for measuring the criterion and a necessary condition for the 
resistance to differential cryptanalysis. In the differential cryptanalysis 

25 method, an observation is made of the difference between outputs (an output 
difference value) of the S-box corresponding to the difference between its 
two inputs (an input difference value), and if a large imbalance is found 
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between them, it can be used to cryptanalyze the whole cipher. 

Letting the input to the S-box be represented by x, the difference 
value between the two inputs by Ax, the difference value of the two outputs 
corresponding to the two inputs by Ay, the function of the S-box by S and 
5 the output y from the S-box for the input thereto by y=S(x), let {Ax, Ay) be 
the number of those xs of all n-bit inputs x which satisfy the following 
equation (1) for an arbitrary input difference value Ax and an arbitrary 
output difference value Ay. 

S(x) + S(x+Ax) = Ay (1) 

10 where "+" is usually defined by the exclusive OR (XOR) for each bit. As 
described in literature "X. Lai, J. M. Massey, and S. Murphy, 'Markov 
Ciphers and Differential Cryptanalysis,' In D. W. Davies, editor, Advances 
in Cryptology-EUROCRYPT '91, Volume 547 of Lecture Notes in 
Computer Science, pp. 17-38, Springer- Verlag, Berlin, Heidelberg, New 

15 York, 1991," the difference operation can be substituted with an arbitrary 
binary operation that provides a general inverse; the differential 
cryptanalysis method mentioned herein includes them. The differential 
cryptanalysis utilizes an imbalance in the relationship between the operation 
results on two arbitrary inputs and the two outputs corresponding thereto. 

20 The number 3s {Ax, Ay) of inputs x that satisfy Eq. 81) for a given 

pair of Ax and Ay is expressed by the following equation (2): 

8s(Ax,Ay) =#{xGGF(2y \S(x) + S(x + Ax) = Ay} (2) 
where #{x| conditional equation} represents the number of inputs x that 
satisfy the conditional equation. The number 3^ {Ax, Ay) of inputs x can be 

25 calculated from Eq. (2) for all pieces of n-bit data A x as the input difference 
value, except 0, and all pieces of m-bit data Ay as the output difference 
value. A combination of Ax and Ay that maximizes the above-said 
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number constitutes a vulnerability to the differential cryptanalysis-this 
means that the smaller the maximum value of (Ax, Ay), the higher the 
resistance to differential cryptanalysis. Therefore, it is the necessary 
condition for the resistance to differential cryptanalysis that the criterion for 
5 differential cryptanalysis, , given by the following equation (3) is small. 
A_5 = max 3 s [Ax, Ay) Q) 
Eq. (3) indicates selecting that one of all the combinations of A;; ;^ 0 and Ay 
which provides the maximum value of 6^ and using it as the value of A^ . 
(b) Necessary Condition for Resistance to Linear Cryptanalysis 

10 A description will be given below of the definition of a criterion for 

linear cryptanalysis as a measure of the resistance thereto of the S-box, a 
method for measuring the criterion and a necessary condition for the 
resistance to linear cryptanalysis. 

In the linear cryptanalysis method, an observation is made of an 

15 arbitrary exclusive OR between the input and output values of the S-box, 
and if a large imbalance is found between them, it can be used to 
cryptanalyze the whole cipher. 

Letting the input to the S-box be represented by x, an input mask 
value by r X and an output mask value by T y, (Tx, Ty) defined by the 

20 following equation (4) can be calculated for a certain input mask value r x 
and a certain output mask value Ty. 

A, (Tx, Ty) = |2x# {c G (2)" \xTx = S (x) • Ty} - 2" \ (4) 

where " • " is usually defined by the inner product, x • Tx means summing- 
up of all only those bit values in the input x which correspond to "Is" in 
25 the mask value r x, ignoring the bit values corresponding to "Os". That is, 
X • Fx = (where 2 is the sum total of i-th bits in r x which are "Is"), 
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where x=(x„.i, ... , Xq). The same is true of y • . Accordingly, Eq. (4) 
expresses the absolute value of a value obtained by subtracting 2° from the 
double of the number of those of all (2") n-bit inputs x which satisfy 
X • r x=S(x) • r y for given sets of mask values ( r x, r y). 
5 From Eq. (4) A, (Tx, Ty) can be calculated for all sets of n-bit data 

r X as the input mask value and m-bit data r y as the output mask value, 
except 0. A combination of rxand rythat 

maximizes A5 (Fa:, ry) constitutes a vulnerability to the linear cryptanalysis-- 
this means that the smaller the maximum value of (rx,Ty) , the higher the 
10 resistance to linear cryptanalysis. Therefore, it is the necessary condition 
for the resistance to linear cryptanalysis that the criterion for linear 
cryptanalysis, , given by the following equation (5) is small. 

A5 =maxA^(rA;,r>;) (5) 
Eq. (5) indicates selecting that one of all the combinations of Fx 
15 and r y 0 which provides the maximum value of A^ (Fx, Ty) and setting as 
the value of . 

(c) Necessary Condition for Resistance to Higher Order Differential Attack 
A description will be given below of the definition of a criterion for 

higher order differential attack as a measure of the resistance thereto of the 
20 S-box, a method for measuring the criterion and a necessary condition for 

the resistance to higher order differential attack. 

The higher order differential attack utilizes the fact that the 

computation of a higher order differential the intermediate output in the 

course of encryption with respect to the input provides a key-independent 
25 constant. An arbitrary bit of arbitrary intermediate data during encryption 

can be expressed by a Boolean polynomial regarding the input. For 

instance, a bit yj of certain intermediate data can be expressed by a Boolean 
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polynomial regarding an N-bit input x as follows: 

Yj = X0+X1X3+X0X2X3+ ... +X1X4X5X6 ... Xn (6) 
When the degree of the Boolean polynomial is d, the calculation of the 
(d+l)-th order differential (for instance, XOR of 2^^^ outputs) results in 
5 providing a key-independent constant; attacks on ciphers of low-degree 
Boolean polynomials are reported in the afore-mentioned literature A. 

With a low-degree Boolean polynomial representation of an F- 
function, an insufficient number of iterations of the F-function will not raise 
the degree of the Boolean representation of the whole cipher, increasing the 
10 risk of the cipher being cryptanalyzed. Hence, a necessary condition for 
making the cipher secure against higher order differential attack without 
increasing the number of iterations of the F-function is that the degree of the 
Boolean polynomial representation of the S-box as a component of the F- 
function is also high. 
15 For 

S-box S: GF(2)'^-GF(2)'" ; xh^S(x), 

set 

y = S(x), (7a) 
x = (x,.i,x„.2, ...,Xo) eGF(2)", (7b) 
20 y = (y,.i, ... , yo) e GF(2)- (7c) 

And a set of variables X = {x„.i, x^_2' " ' Xq} is defined. At this time, a 

Boolean function = Si(x) is defined as follows: 

Si : GF(2)" -» GF(2); x Si(x) (8) 

Let deg^Sj denote the degree of the Boolean function Sj (Osi^m-1) 
2 5 regarding the variable set X. Let the minimum value of deg^Si (0 s i s m- 1) 

be represented by deg^S, which is the criterion for higher order differential 

attack. 
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deg,S = min(deg,Si) (9) 
where min is conditioned by 0 s i m-1. 
A necessary condition that the S-box needs to satisfy to provide security 
against higher order differential attack is that deg^S has a large value. It is 
5 known that when S is bijective (i.e. the input/output relationship can be 

determined uniquely in both directions), the maximum value of deg^S is n-1. 
(d) Necessary Condition for Resistance to Interpolation Attack 

A description will be given below of the definition of a criterion for 
interpolation attack as a measure of the resistance thereto of the S-box, a 
10 method for measuring the criterion and a necessary condition for the 
resistance to interpolation attack. 

The principle of interpolation attack is as follows: With a key k 
fixed, a ciphertext y can be expressed, for example, by the following 
equation using a polynomial fk(x) over GF(q) regarding a plaintext x. 
15 y = fk(x) = Cq.ixi-i + Cq.2x'»-^ + ... + CjXJ + ... +c,x' + Cqx" (10) 

where q is a prime or its power. When the number of terms of non-zero 
coefficients contained in the polynomial 4(x) with respect to x is c, the 
polynomial fk(x) can be constructed as by the Lagrange mterpolation 
theorem if c different sets of plaintexts and the corresponding sets of 
20 ciphertexts (xj, yj) (where i = 1, ... , c) are given. By this, a ciphertext 
corresponding a desired plaintext x can be obtained. 

The larger the number of terms contained in the polynomial fk(x), the 
larger the number of sets of plaintexts and ciphertexts necessary for 
interpolation attack using the polynomial representation fk(x) over GF(q), 
25 and the attack becomes difficult accordingly or becomes impossible. 
When the number of terms contained in the polynomial 
representation over GF(q) of the S-box is small, there is a possibility that the 
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number of terms contained in the polynomial of the whole cipher over GF(q) 
decreases. Of course, even if the number of terms contained in the 
polynomial over GF(q) of the S-box is large, care should be taken in the 
construction of the whole cipher to avoid that the terms cancel out each 
5 other, resulting in a decrease in the number of terms contained in the 
polynomial over GF(q) of the whole cipher; however, this concerns 
encryption technology, and as the criterion of the S-box for interpolation 
attack, it is a necessary condition for the resistance to interpolation attack 
that the number of terms contained in the polynomial representation over 
1 0 GF(q) is large. Let the number of terms contained in the polynomial 

representation over GF(q) of the function S of the S-box be represented by 
coeffqS, which is used as the criterion for interpolation attack using the 
polynomial representation over GF(q). 

Since the interpolation attack exists by the number of possible qs, it 
15 is desirable to calculate the number of terms coeffqS in as many polynomials 
over GF(q) as possible and make sure that they do not take small values, 
(e) Necessary Condition for Resistance to Partitioning Cryptanalysis 

A description will be given below of the definition of a criterion for 
partitioning cryptanalysis as a measure of the resistance thereto of the S-box, 
20 a method for measuring the criterion and a necessary condition for providing 
the resistance to partitioning cryptanalysis. In partitioning cryptanalysis, 
an observation is made of some measure which holds for a certain subset of 
the whole plaintext set and a certain subset of the whole ciphertext set, and 
if a large imbalance is found in the measure, then it can be used to 
25 cryptanalyze the whole cipher. As "some measure I" there are mentioned a 
peak imbalance and a squared Euclidean imbalance in literature "C. Harpes, 
J. L. Massey, 'Partitioning Cryptanalysis,' Fast Software Encryption 
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Workshop (FSE4) (Lecture Notes in Computer Science 1267), pp. 13-27, 
Springer- Verlag, 1997." 

In literature "Takeshi Hamada, Takafumi Yokoyama, Tohru Shimada, 
Toshinobu Kaneko, 'On partitioning cryptanalysis of DBS,' Proc. in 1998 
5 Symposium on Cryptography and Information Security (SCIS'98-2,2.A)," it 
is reported that an attack on the whole cipher succeeded through utilization 
of imbalance observed m input and output sets of the S-box of the DBS 
cipher-this indicates that the criterion for partitioning cryptanalysis 
similarly defined for the input and output sets of the S-box is a necessary 
1 0 condition for the whole cipher to be secure against partitioning 
cryptanalysis. 

Let u divided subsets of the whole set of S-box inputs be represented 
by Fo, Fi, ... , F„.i and v divided subsets of the whole set of S-box outputs by 
Go, Gi, ... , G^.i. Suppose that all the subsets contain an equal number of 

15 elements. A function f for mapping the input x on the subscript {0, 1, ... , 
u-1} of each subset will hereinafter be referred to as an input partitioning 
function and a function g for mapping the output y on the subscript {0, 1, ... , 
v-1} of each subset as an output partitioning function. That is, the function 
f indicates the input subset to which the input x belongs, and the function g 

20 indicates the output subset to which the output y belongs. Let partitions F 
and G be defined by 



F = {Fo,Fi, ...,F„.J, 
G = {Go, Gi, G^.i}. 
Then, an imbalance I,(F, G) of an S-box partition pair (F, G) is given by the 
25 following equation (11). 




(11) 
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Expressing I(g(S(x))|F(x)=i on the right-hand side of Eq. (11) by I(V), this is 
the afore-mentioned "Measure L" Accx)rding to the afore-mentioned 
literature by C. Harpes et al., in the case of using the peak imbalance as this 
measure, it is expressed as follows: 



In the case of using the squared Euclidean imbalance as this measure, it is 
expressed as follows: 



P[V=j] represents the probability that the whole output y corresponding to 
10 the whole input x of an i-th (i=0, ... , u-1) input group Fj assigned to an 
output group Gj (j=0, ... , v-1), and the sum total of probabilities of the 
assignment to respective output groups is 1. For example, if kj outputs of 
the whole output y (Iq outputs) corresponding to the whole input x (assumed 
to consist of kj inputs) are assigned to the group Gj, then the probability of 
1 5 assignment to the group Gj is kj/kj. The peak imbalance Ip(V) of Eq. (12) 
represents a value obtained by normalizing imbalance of the maximum 
assignment probability relative to an average probability, and the Euclidean 
imbalance Ie(V) of Eq. (13) represents a value obtained by normalizing a 
square-sum of imbalance of the assignment probability from the average one. 
20 This measure Ip or is applied to Eq. (11) to calculate the imbalance Is(F, 
G) for each partition-pair (F, G). The partition-pair varies, for instance, 
with the way of selecting the partitioning functions f and g. For example, 
the division numbers u and v are also parameters that are specified by the 
functions f and g. 

25 The measure given by Eq. (11) is the criterion for the partitioning 



5 




(12) 




(13) 
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attack on the S-box and takes a value greater than 0 and smaller than 1; it is 
a necessary condition for the resistance to the partitioning attack that the 
difference between the above value and its one-half is small. Accordingly, 
the S-box function is chosen which minimizes the value |Is(F, G)-l/2|. 
(f) Necessary Condition for Resistance to Differential-Linear Cryptanalysis 

A description will be given below of the definition of a criterion for 
differential-linear cryptanalysis as a measure of the resistance thereto of the 
S-box, a method for measuring the criterion and a necessary condition for 
providing the resistance to differential-linear cryptanalysis. 

In differential-linear cryptanalysis, an observation is made of, for 
example, the exclusive OR of S-box mput and output difference values, and 
if a large imbalance is found, then it can be used to cryptanalyze the whole 
cipher. 

Letting the S-box input, input difference value and output mask 
value be represented by X, Ax and r y, respectively, ^s(^x, ry) defined 
by the following equation can be calculated. 

(Ax, Ty) = \2#{x e GFi2y\[S(x) + 5(x + Ax)] • = 1} - 2" | (14) 

where the operations "+" and " • " are the same as those used in the criterion 
for differential cryptanalysis and the criterion for linear cryptanalysis, 
respectively. The maximum value H s given by the following equation for 
any one of all combinations of Ax and r y in the measure ls(Ax, Ty) 
thus calculated is used as the criterion for differential-linear cryptanalysis. 
= max^5(A^>r>;) (15) 

Since a large value of the criterion S s may be a weakness in differential- 
linear cryptanalysis, it is a necessary condition for the resistance thereto that 
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this value is small (no marked imbalance). 

Incidentally, such functions S as expressed by the following 
equations are used in some ciphers. 

S: GF(2)" - GF(2)": x - x^*^ in GF(2'') (16a) 
5 S: GF(2)" - GF(2)": x ^ x^''^^ in GF(2") (16a) 

Letting k denote a natural number equal to or greater than n, the differential- 
linear attack criteria of these functions S take 2n (the maximum theoretical 
value). No report has been made of an example in which this property 
leads to a concrete cipher attack, but it is desirable that the criteria take as 
10 small a value as possible. 

Next, a description will be given of an embodiment according to a 
second aspect of the present invention. 

The resistance of the S-box to various attacks is evaluated as 
described above, but the generation of a highly resistant random function 
15 gives rise to an issue of how to select a group of candidate functions. The 
reason for this is that much complexity is needed to select functions 
satisfying the above-mentioned condition from an enormous number of 
functions. 

By the way, from an example cited in literature "T. Jakobsen, L. R. 

20 Knudsen, 'The Interpolation Attack on Block Cipher,' Fast Software 

Encryption Workshop (FSE4) (Lecture Notes in Computer Science 1267), 
pp. 28-40, Springer- Verlag, 1997," it is known that the block cipher is 
readily cryptanalyzed by the higher order and the interpolation cryptanalysis 
in the case where the S-box is formed by a function of a certain algebraic 

25 structure selected as a function resistant to the differential and the linear 
cryptanalysis and the whole cipher is constructed in combination with only 
by an operation which does not destroy the algebraic structure. On the 
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other hand, the inventors of this application have found that a composite 
function, which is a combination of a function resistant to the differential 
and the linear cryptanalysis with a function of a different algebraic structure 
(basic operation structure), is also resistant to other attacks in many cases. 
5 According to the second aspect of the present invention, functions 

resistant to the differential and the linear cryptanalysis and functions which 
have algebraic structures different from those of the first-mentioned 
functions are combined (composition of functions, for instance) and such 
composite functions are selected as groups of candidate functions; the 
10 resistance to each cryptanalysis is evaluated for each function group and 
functions of high resistance are chosen. 

Incidentally, the way of selecting the candidate function groups in 
the present invention is not limited specifically to the above. 

According to the second aspect of the present invention, a function 
1 5 (for example, a composite function), which is a combination of at least one 
function resistant to the differential and the linear cryptanalysis with at least 
one function of a different algebraic structure is selected as a candidate 
function group. With this scheme, it is possible to efficiently narrow down 
from a small number of candidates those functions which are resistant not 
20 only to the differential and the linear cryptanalysis but also to attacks which 
utilize the algebraic structures of the functions used, such as the higher order 
differential and the interpolation attack. 

In the following embodiment according to the second aspect of the 
present invention, a description will be given of how to design an 8 -bit I/O 
25 S-box. 

Now, consider that a P-function part 21for generating a function P(x, 
e) and an A-function part 22 for generating a function A(y, a, b) of an 
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algebraic structure different from the function P(x, e) are combined as a 
candidate function for forming and S-box 20 as shown in Fig. 2. 
S: GF(2/ -> GF(2)^ x A((P(x, e)), a, b) 

where 

5 P(x, e) = x^ in GF(2«) (17) 

A(y, a, b) = ay + b(mod 2") (18) 
The function P(x, e) defined by Eq. (17) is a power function to be defined 
over Galois Field GF(2^); this function is resistant to differential 
cryptanalysis and linear cryptanalysis when the parameter e is selected 
10 suitably, but it has no resistance to higher order differential, linear- 
differential, interpolation and partitioning attacks. On the other hand, the 
function A(y, a, b) defined by Eq. (18) is constructed by a simple addition 
and a simple multiplication, and this function has no resistance to any of the 
attacks. 

15 Here, the parameters a, b and e can freely be set to any natural 

numbers in the range of from 0 to 255 (i.e. 2^-1). Of them, the parameters 
a and b need to have a Hamming weight greater than 3 but smaller than 5, 
that is, these parameters a and b are each 8-bit and required to have three to 
five "1" (or "0") bits, and the S-box needs to be bijective; the parameters a, 

20 b and c are narrowed down by evaluating whether they satisfy such 

necessary conditions for providing security against differential cryptanalysis, 
linear cryptanalysis, interpolation attack and partitioning attack. 

In Fig. 3 there is depicted the procedure of an embodiment of the 
apparatus according to the present invention. Incidentally, the invention is 

25 not limited specifically to this embodiment. There is flexibility in the way 
of selecting functions as candidates for the S-box. Further, the number of 
design criteria for the S-box is also large, and their priority their priority and 
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the order of narrowing down the candidates are also highly flexible. 

Step SI: In the input part 11, predetermine the range of each of the 
parameters a, b and e in Eqs. (17) and (18) to be greater than 0 but smaller 
than 2^-1, and limit the Hamming weights Wh(a) and Wh(b) of the 
5 parameters a and b to the range of from 3 to 5. 

Step S2: Evaluate whether candidate functions S are bijective or not. 
When the parameter a is an odd number and the parameter e is prime 
relative to 2^-1 (which parameter is expressed by (e,255)=l), the functions S 
are bijective; select those of the parameters which satisfy these conditions, 
10 and discard candidates which do not satisfy them. This processing is 

performed in the criteria evaluating part 14g in Fig. 1. Alternatively, the 
parameter a is obtained by inputting only an odd number in the input part 11. 

Step S3: It is known that the Hamming weight Wh(e) of the 
parameter e (which weight indicates the number of "Is" in e in the binary 
15 representation; for example, if e = 11101011, Wh(e) = 6) and the degree 

degjP of the function P in the Boolean function representation are equal to 
each other. The, in order to satisfy the condition for a criterion deg^S of the 
remaining candidate functions S for higher order differential attack, select 
those of the remaining candidate functions S whose parameters e having a 
20 Hamming weights Wh(e) of 7 that is the theoretically maximum value of e, 
that is, select e = 127, 191, 223, 239, 251, 253 and 254. Discard the 
candidates that do not meet the condition. 

Step S4: Determine if any candidates still remain undiscarded. 

Step S5: When it is determined in the preceding step that no 
25 candidate has survived, ease the condition Wii(e) ^ Wh(e)-1 and then go back 
to step S3. 

Step S6: From the candidate functions remaining after the process of 
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Step S3, select those candidates for which the criterion A s for differential 
attack defined by Eq. (3) is smaller than a predetermined reference value 
Ar. Discard the candidates that do not meet this condition. 

Step S7: Determine if any candidates still remain undiscarded after 
5 Step S6. 

Step S8: If no candidate remains, add a predetermined step width A^ 
to the reference value Ar (ease the condition) to update it, and return to step 
S6 to repeat the processing. 

Step S9: From the candidate functions S remaining after Step S6, 
10 select those candidates for which the criterion A s for linear attack defined 
by Eq. (5) is smaller than a predetermined reference value Ar. Discard 
the candidates that do not meet this condition. 

Step SIO: Determine if any candidates still remain undiscarded after 
Step S9. 

15 Step 11: If no candidate remains, add a predetermined step width A^ 

to the reference value Ar (ease the condition) to update it, and return to step 
S9 to repeat the processing. 

Step S12: From the candidate functions S remaining after step S9, 
select those candidates for which the criterion S s for differential-linear 
20 attack defined by Eq. (15) is smaller than a predetermined reference value 
S R. Discard the candidates that do not meet this condition. 

Step S13: Determine if any candidates still remain undiscarded after 
Step S12. 

Step S14: If no candidate remains, add a predetermined step width 
25 S d to the reference value S r (ease the condition) to update it, and retum to 
step S12 to repeat the processing. 

As a result, the parameters are narrowed down to those given below. 
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(a, b) = (97, 97), (97, 225), (225, 97), (225, 225) 

e = 127, 191, 23, 239, 247, 251, 253, 254 
Step S15: For the candidate functions S by all combinations of the 
parameters remaining after Step S12, calculate the criterion Is(F, G) for 
5 partitioning attack and select those candidates for which |IS(F, G)-l/2| is 
smaller than a reference value Ir. Discard the candidates that do not meet 
this condition. 

Step S16: Determine if any candidates still remain undiscarded after 
Step S15. 

10 Step S17: If no candidate remains, add a predetermined step width 1^ 

to the reference value Ir (ease the condition) to update it, and return to step 

S15 to repeat the processing. 

Step S18: For the candidate functions S by all combinations of the 

parameters remaining after Step S15, select those candidates for which the 
1 5 criterion coeffqS (where q = 28) for interpolation attack, which utilizes the 

polynomial over GF(2^), is larger than a reference value CqR, and discard the 

other candidates. 

Step S19: Determine if any candidates still remain undiscarded after 
Step S18. 

20 Step S20: If no candidate remains, subtract a predetermined step 

width Cqd from the reference value c^r (ease the condition) to update it, and 

return to step S19 to repeat the processing. 

Step S21: From all primes p in the range of from 2^+1 to 2', select 

those of the candidate functions S for which the criterion coef^S for 
25 interpolation attack is larger than the reference value CpR, and discard the 

other candidates. 

Step S22: Determine if any candidates still remain undiscarded after 
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Step S21. 

Step S23: If no candidate remains, subtract a predetermined step 
width Cpd from the reference value CpR (ease the condition) to update it, and 
return to step S21 to repeat the processing. 

As the result of the evaluation described above, the following 
combinations (a total of 32 combinations) of parameters are left 
undiscarded. 

(a, b) = (97, 97), (97, 225), (225, 97), (225, 225) 
(e) = 127, 191, 223, 239, 247, 251, 253, 254 

This is identical with the results obtained in step S12. This means 
that functions secure against every attack taken into account in this 
embodiment are already obtained in step S12. 

Since the 32 functions thus selected are equally strong on the above- 
mentioned criteria, any of the functions can be used as the S-box. 

In the evaluation of the S-box or in the function generation, the 
reference values A r, A r, S r, c^r and CpR of the criteria for evaluation are 
each determined according to the required degree of randomness, that is, the 
required security against the respective cryptanalysis. 

In the flowchart o Fig. 3, the order of selection of function 
candidates having the required resistance to the respective attacks 
(cryptanalyses) is not limited specifically to the order depicted in Fig. 3 but 
may also be changed. 

With the random function generating method according to the 
present invention, it is unnecessary to select function candidates that have 
the required resistance to every attack shown in Fig. 3; and it also falls 
inside the scope of the present invention to select function candidates for at 
least one of higher order differential, differential-linear, partitioning and 
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interpolation attacks. Instead of narrowing down the function candidates 
one after another for a plurality of cryptanalysis methods, it is also possible 
to evaluate the resistance of every function candidates to the respective 
cryptanalyses and select functions that have the reference resistance to them. 
5 While in the above the random function generating method has been 

described to determine parameters of composite functions each composed of 
two functions, it need scarcely be said that the method is similarly 
applicable to parameters of functions each composed of three or more 
functions and to the determination of parameters of one function. 

10 The function randomness evaluating method and the random 

function generating method of the present invention, described above in the 
first and second embodiments, may also be prerecorded on a recording 
medium as programs for execution by a computer so that the programs are 
read out and executed by the computer to evaluate the randomness of 

15 functions and generate random functions. 

EFFECT OF THE INVENTION 

As described above, according to the present invention, in the 
method and apparatus for evaluating the randomness of S-box functions that 

20 serve as components of an cryptographic device or the like, there is provided, 
in addition to the conventional evaluating method, means for evaluating 
whether the functions is resistant to differential, linear, higher order 
differential, interpolation, partitioning and differential-linear attacks and 
other possible attacks, whereby it is possible to evaluate the randomness of 

25 the functions and design ciphers highly secure against the above 
cryptanalyses. 

Furthermore, since functions each formed by a combination of a 
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function resistant to differential cryptanalysis and linear cryptanalysis and a 
function of an algebraic structure different from that of the first-mentioned 
function are selected as candidate functions, functions resistant not only to 
the differential and linear cryptanalyses but also to attacks utilizing the 
5 algebraic structure, such as high order differential and interpolation attacks 
can be narrowed down from a small number of candidates. 

Moreover, such a procedure as depicted in Fig. 3 allows efficient 
narrowing down of functions with a small amount of computational 
complexity. 

1 0 Besides, by selecting candidate functions from combinations of 

functions of well-known different algebraic structures instead of selecting 
the candidates at random, it is also easy to show that the S-box has no trap- 
door (a secret trick that enables only a designer to cryptanalyze the cipher 
concerned). 

15 The random function thus evaluated and generated by the present 

invention is used as the S-box formed as by a ROM to generate an irregular 
outputs from the input to a cryptographic device which conceals data fast 
and securely. 

20 



25 
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WHAT IS CLAIMED IS: 

1. A function randomness evaluating apparatus comprising at least 

one of: 

higher-order-differential cryptanalysis resistance evaluating means 
for calculating the minimum value of the degree of a Boolean polynomial 
for input bits by which output bits of a function to be evaluated are 
expressed, and evaluating that the larger said minimum value, the higher 
the resistance of said function to higher order differential cryptanalysis is; 

interpolation-cryptanalysis resistance evaluating means for: when 
fixing a key y and letting x denote the input of a function to be evaluated, 
expressing an output y by y = 4(x) using a polynomial over Galois field 
which is composed of elements equal to a prime p or a power of said prime 
p; calculating the number of terms of said polynomial; and evaluating the 
resistance of said function to interpolation cryptanalysis based on the result 
of said calculation; 

partitioning-cryptanalysis resistance evaluating means for: dividing 
all inputs of a function to be evaluated and the corresponding outputs into 
input subsets and output subsets; calculating an imbalance of the 
relationship between the subset of an input and the subset of the 
corresponding output with respect to their average corresponding 
relationship; and evaluating the resistance of said function to partitioning 
cryptanalysis based on the result of said calculation; and 

differential-linear-cryptanalysis resistance evaluating means for: 
calculating, for all sets of input difference Ax and output mask value r y of 
a function S(x) to be evaluated, the number of inputs x for which the inner 
product of (S(x)+S(x Ax)) and said output mask value ry is 1; and 
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evaluating the resistance of said function to differential-linear cryptanalysis 
based on the result of calculation. 

2. The function randomness evaluating apparatus of claim 1, 
wherein: 

said partitioning-cryptanalysis resistance evaluating means is means 
for: dividing an input set F and an output set G of said function into u input 
subsets {Fo, Fi, ... , p^.^} and v output subsets {Gq, G^, ... , G^.J; for each 
partition-pair (Fj, Gj) (i = 0, ... , u-1; j = 0, 1, ... , v-1), calculating the 
maximum one of probabilities that all outputs y corresponding to all inputs x 
of the input subset Fj belong to the respective output subsets Gj (j = 0, ... , v- 
1); calculating a measure Is(F, G) of an average imbalance of a partition-pair 
(F, G) based on all maximum values calculated for all partition pairs; and 
evaluating the resistance of said function to said partitioning cryptanalysis 
based on said measure; and 

said differential-linear cryptanalysis resistance evaluating means is 
means for: calculating the following equation for every set of said input 
difference A x except 0 and said output mask value r y except 0 

{Ax, Ty) = |2x#{jc e GF(2)" \(S{x) + S{x + Ax))Ty = l}-2"\; 

calculating the maximum value H among the calculation results; and 
evaluating the resistance of said function to said differential-linear 
cryptanalysis based on said value S . 

3. The function randomness evaluating apparatus of claim 1 or 2, 
further comprising at least one of: 

differential-cryptanalysis resistance evaluating means for calculating, 
for a function S(x) to be evaluated, the number of inputs x that satisfy 
S(x)+S(x+S(x+ A x)= A y for every set (Ax, Ay) and evaluating the 
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resistance of said function to differential cryptanalysis based on the result of 
said calculation; and 

linear-cryptanalysis resistance evaluating means for calculating, for a 
function to be evaluated, the number of inputs x for which the inner product 
of the input x and its mask value Fx is equal to the inner product of a 
function output value S(x) and its mask value Ty and evaluating the 
resistance of said function to linear cryptanalysis based on the result of said 
calculation. 

4. The randomness evaluating apparatus of claim 3, wherein said 
linear-cryptanalysis resistance evaluating means is means for calculating the 
following equation 

ks {Tx, Ty) = ^^#\cE: (2)" |jc • Fx = • } - 2" | 

for every set of mask values (Fx, r y) except r y=0, and evaluating the 
resistance of said function to said linear cryptanalysis based on a criterion 
defined by the following equation 
= max (rx,ry). 

5. The randomness evaluating apparatus of claim 3, wherein said 
differential-cryptanalysis resistance evaluating means is means for 
calculating the following equation 

8s{l^,ky)=#{xE:GF{2y \S{x) + S{x + ^x) = Ay} 
for every set of difference values (Ax, Ay) except A x=0, and evaluating 
the resistance of said function to said differential cryptanalysis based on a 
criterion defined by the following equation 

Ac = max 

6. A random function generating apparatus comprising: 
candidate function generating means for generating candidate 
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functions each formed by a combination of a plurality of functions of 
different algebraic structures and having a plurality of parameters; 

resistance evaluating means for evaluating the resistance of each of 
said candidate functions to a cryptanalysis; and 

selecting means for selecting those of said resistance-evaluated 
candidate functions which have highly resistant to said cryptanalysis. 

7. The random function generating apparatus of claim 6, wherein one 
of said plurality of functions of different algebraic structures is resistant to 
each of differential cryptanalysis and linear cryptanalysis. 

8. The random function generating apparatus of claim 6 or 7, 
wherein said resistance evaluating means comprises at least one of: 

higher-order-differential cryptanalysis resistance evaluating means 
for: calculating the minimum value of the degree of a Boolean polynomial 
for input bits by which output bits of each of said candidate functions are 
expressed; and evaluating the resistance of said each candidate function to 
higher order cryptanalysis based on the result of said calculation; 

interpolation-cryptanalysis resistance evaluating means for: when 
fixing a key y and letting x denote the input of said each candidate, 
expressing an output y by y = 4(x) using a polynomial over Galois field 
which is composed of elements equal to a prime p or a power of said prime 
p; calculating the number of terms of said polynomial; and evaluating the 
resistance of said each candidate function to interpolation cryptanalysis 
based on the result of said calculation; 

partitioning-cryptanalysis resistance evaluating means for: dividing 
all inputs of a function to be evaluated and the corresponding outputs into 
input subsets and output subsets; calculating an imbalance of the 
relationship between the subset of an input and the subset of the 
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corresponding output with respect to their average corresponding 
relationship; and evaluating the resistance of said function to partitioning 
cryptanalysis based on the result of said calculation; and 

differential-linear cryptanalysis resistance evaluating means for: 
calculating, for every set of input difference Ax and output mask value ry 
of a function S(x) to be evaluated, the number of inputs x for which the 
inner product of (S(x)+S(xAx)) and said output mask value Ty is 1; and 
evaluating the resistance of said function to differential-linear cryptanalysis 
based on the result of said calculation. 

9. A method for evaluating the randomness of the input/output 
relationship of a function, said method comprising at least one of: 

(a) a higher-order-differential cryptanalysis resistance evaluating 
step of: letting said function be represented by S(x), calculating the 
minimum value of the degree of a Boolean polynomial for input bits of said 
function S(x) by which its output bits are expressed; and evaluating the 
resistance of said function to higher order cryptanalysis based on the result 
of said calculation; 

(b) a differential-linear cryptanalysis resistance evaluating step of: 
calculating, for every set of input difference Ax and output mask value r y 
of a function S(x) to be evaluated, the number of inputs x for which the 
inner product of (S(x)+S(x Ax)) and said output mask value ry is 1; and 
evaluating the resistance of said function to differential-linear cryptanalysis 
based on the result of said calculation; 

(c) a partitioning-cryptanalysis resistance evaluating step of: dividing 
all inputs of a function to be evaluated and the corresponding outputs into 
input subsets and output subsets; calculating an imbalance of the 
relationship between the subset of an input and the subset of the 
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corresponding output with respect to their average corresponding 
relationship; and evaluating the resistance of said function to partitioning 
cryptanalysis based on the result of said calculation; and 

(d) an interpolation-cryptanalysis resistance evaluating step of: when 
fixing a key y and letting x denote the input of said each candidate, 
expressing an output y by y = f,,(x) using a polynomial over Galois field 
which is composed of elements equal to a prime p or a power of said prime 
p; calculating the number of terms of said polynomial; and evaluating the 
resistance of said function to interpolation cryptanalysis. 

10. The randomness evaluating method of claim 9, wherein: 
said differential-linear cryptanalysis resistance evaluating step (b) is 
a step of:, letting the input difference and output mask value of said function 
S(x) be representing by Ax and Ty, respectively, calculating the following 
equation for every set of said input difference Ax except 0 and said output 
mask value r y except 0 

i^,Ty) = |2x#{x eGF(2)" \(S(x) + 5(x + Ax) • = 1} - 2" | ; 

calculating the maximum value S among the calculation results; and 
evaluating the resistance of said function to said differential-linear 
cryptanalysis using said value 3 ; and 

said partitioning-cryptanalysis resistance evaluating step (c) is a step 
of: dividing an input set F and an output set G of said function into u input 
subsets {Fo, F^, ... , p^.j} and v output subsets {Gq, G^, ... , G^.^}; for each 
partition-pair (Fj, Gj) (i = 0, ... , u-1; j = 0, 1, ... , v-1), calculating the 
maximum one of probabilities that all outputs y corresponding to all inputs x 
of the input subset F^ belong to the respective output subsets Gj (j = 0, ... , v- 
1); calculating a measure Is(F, G) of an average imbalance of a partition-pair 
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(F, G) based on all maximum values calculated for all partition pairs; and 
evaluating the resistance of said function to said partitioning cryptanalysis 
based on said measure. 

11. The randomness evaluating method of claim 9 or 10, further 
comprising at least one of: 

(e) a differential-cryptanalysis resistance evaluating step of: letting 
the output difference value of said function S(x) be represented by A x, 
calculating the number of inputs x that satisfy S(x)+S(x+S(x+Ax)= Ay for 
every set (Ax, Ay) except Ax=0; and evaluating the resistance of said 
function to differential cryptanalysis based on the result of said calculation; 
and 

(f) a linear-cryptanalysis resistance evaluating means for calculating, 
for said function S(x), the number of mputs x for which the inner product of 
the input x and its mask value r x is equal to the inner product of a function 
output value S(x) and its mask value r y and evaluating the resistance of 
said function to linear cryptanalysis based on the result of said calculation. 

12. The randomness evaluating method of claim 11, wherein, letting 
the number of bits of said input x be represented by n: 

said differential-cryptanalysis resistance evaluating step (e) is a step 
of: calculating the following equation 

Ss (Ax, Ay) =#{x e GF(2)" \S{x) + S{x + Ax) = Ay} 

for every set of difference values (Ax, Ay) except Ax=0; and evaluating 
the resistance of said function to said differential cryptanalysis based on a 
criterion defined by the following equation 

A 5 = max ds (Ajc, Ay) ; and 

said linear-cryptanalysis resistance evaluating step (f) is a step of: 
letting the mask value of said input x be represented by r x, calculating the 
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foUowing equation 

A, {Tx, ry ) = |2x# G (2)" \xTx = S(xyTy}-2"\ 

for every set of mask values (Fx, Fy) except ry=0; and evaluating the 
resistance of said function to said linear cryptanalysis based on a criterion 
defined by the following equation 
= max {Tx, Ty) . 

13. A random function generating method comprising the steps of: 

(a) setting various values as each parameter for candidate functions 
and calculating output values corresponding to various input values; 

(b) storing the results of said calculation in storage means; and 

(c) evaluating the resistance of each of said candidate functions to a 
cryptanalysis based on values stored in said storage means, and selectively 
outputting candidate function highly resistant to said cryptanalysis; and 

wherein said step (c) comprising at lease one of: 
(c-1) a higher-order cryptanalysis resistance evaluating step of: 
calculating the minimum value of the degree of a Boolean polynomial for 
input bits of each of said candidate functions by which its output bits are 
expressed; evaluating the resistance of said each candidate function to 
higher order cryptanalysis based on the result of said calculation; and 
leaving those of said candidate functions whose resistance is higher than a 
predetermined first reference and discarding the others; 

(c-2) a differential-linear cryptanalysis resistance evaluating step of: 
calculating, for every set of input difference Ax and output mask value r y 
of each candidate function S(x), the number of inputs x for which the inner 
product of (S(x)+S(x Ax)) and said output mask value ry is 1; evaluating 
the resistance of said function to differential-linear cryptanalysis based on 
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the result of said calculation; and leaving those of said candidate functions 
whose resistance is higher than a predetermined second reference and 
discarding the others; 

(c-3) a partitioning-cryptanalysis resistance evaluating step of: 
dividing all inputs of each candidate function and the corresponding outputs 
into input subsets and output subsets; calculating an imbalance of the 
relationship between the subset of an input and the subset of the 
corresponding output with respect to their average corresponding 
relationship; evaluating the resistance of said each candidate function to said 
partitioning cryptanalysis based on the result of said calculation; and leaving 
those of said candidate functions whose resistance is higher than a 
predetermined third reference and discarding the others; and 

(c-4) an interpolation-cryptanalysis resistance evaluating step of: 
when fixing a key y and letting x denote the input of said each candidate, 
expressing an output y by y = fj,(x) using a polynomial over Galois field 
which is composed of elements equal to a prime p or a power of said prime 
p; calculating the number of terms of said polynomial; evaluating the 
resistance of said function to interpolation cryptanalysis; and leaving those 
of said candidate functions whose resistance is higher than a predetermined 
fourth reference and discarding the others. 

14. The random function generating apparatus of claim 13, wherein: 

said differential-linear-cryptanalysis resistance evaluating step (c-2) 
includes a step of: letting the output mask value be represented by ry, 
calculating the following equation for every set of said input difference Ax 
except 0 and said output mask value r y except 0 

§5 {Ax, Ty) = \2x#{x&GF(2y \(S(x) + 5(x + Ax)) • Ty = 1} - 2" | ; 



-35- 



calculating the maximum value H among the calculation results; and 
evaluating the resistance of said candidate function to said differential-linear 
cryptanalysis based on said value H ; and 

said partitioningOcryptanalysis resistance evaluating step (3) includes a step 
of dividing an input set F and an output set G of said function into u input 
subsets {Fo, F^, ... , f„.i} and v output subsets {Gq, G^, ... , G^.i}; for each 
partition-pair (Fi, Gj) (i = 0, ... , u-1; j = 0, 1, ... , v-1), calculating the 
maximum one of probabilities that all outputs y corresponding to all inputs x 
of the input subset F; belong to the respective output subsets Gj (j = 0, ... , v- 
1); calculating a measure Is(F, G) of an average imbalance of a partition-pair 
(F, G) based on all maximum values calculated for all partition pairs; and 
evaluating the resistance of said candidate function to said partitioning 
cryptanalysis based on said measure. 

15. The random function generating method of claim 13 or 14, 
wherein: 

said step (c-1) includes a step of: when no candidate function 
remains undiscarded, easing the candidate function selecting condition by 
changing said first reference by a first predetermined width, and executing 
again the evaluation and selecting process; 

said step (c-2) includes a step of: when no candidate function 
remains undiscarded, easing the candidate function selecting condition by 
changing said second reference by a second predetermined width, and 
executing again the evaluation and selecting process; 

said step (c-3) includes a step of: when no candidate function 
remains undiscarded, easing the candidate function selecting condition by 
changing said third reference by a third predetermined width, and executing 
again the evaluation and selecting process; and 
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said step (c-4) includes a step of: when no candidate function 
remains undiscarded, easing the candidate function selecting condition by 
changing said fourth reference by a fourth predetermined width, and 
executing again the evaluation and selecting process. 

16. The random function generating method of claim 13 or 14, 
further comprising at least one of: 

(c-5) a differential-cryptanalysis resistance evaluating step of: 
calculating, for each candidate function S(x), the number of inputs x that 
satisfy S(x)+S(x+S(x+Ax)=Ay for every set (Ax, Ay) except Ax; 
evaluating the resistance of said each candidate function to differential 
cryptanalysis based on the result of said calculation; and leaving those of 
said candidate functions whose resistance is higher than a predetermined 
fifth reference and discarding the others; and 

(c-6) a linear-cryptanalysis resistance evaluating step of: calculating, 
for each candidate function, the number of inputs x for which the inner 
product of the input x and its mask value r x is equal to the inner product of 
a function output value S(x) and its mask value r y; evaluating the 
resistance of said each candidate function to linear cryptanalysis based on 
the result of said calculation; and leaving those of said candidate functions 
whose resistance is higher than a predetermined sixth reference and 
discarding the others. 

17. The random function generating method of claim 16, wherein: 
said differential-cryptanalysis resistance evaluating step (c-5) 

includes a step of: calculating the following equation 

8s (Ajc, Ay) =#{xeGF(2)" \S(x) + 5(x + Ax) = Ay} 
for every set of difference values (Ax, Ay) except ry=0; and evaluating 
the resistance of said each candidate function to said differential 
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cryptanalysis based on a criterion defined by the following equation 

Ag =ms&ds{Ax,Ay); and 

said linear-cryptanalysis resistance evaluating step (c-6) includes a 
step of: calculating the following equation 

(Fx, Fy) = |2x# G (2)" |x • Fx = 5(x) • Tj} - 2" | 

for every set of mask values (Fx, F y); and evaluating the resistance of said 
each candidate function to said linear cryptanalysis based on a criterion 
defined by the following equation 
= max A5 (r^:, Fy) . 

18. The random function generating method of claim 16 or 17, 
wherein: 

said step (c-5) includes a step of: when no candidate function 
remains undiscarded, easing the candidate function selecting condition by 
changing said fifth reference by a fifth predetermined width, and executing 
again the evaluation and selecting process; and 

said step (c-6) includes a step of: when no candidate function 
remains undiscarded, easing the candidate function selecting condition by 
changing said sixth reference by a sixth predetermined width, and executing 
again the evaluation and selecting process. 

19. The random function generating method of claim 13, 14, or 15, 
wherein said candidate functions are each a composite function composed of 
at least one function resistant to said differential cryptanalysis and said 
linear cryptanalysis and at least one function of an algebraic structure 
different from that of said at least one function. 

20. A recording medium having recorded thereon a random function 
generating method as a computer program, said program comprising the 



-38- 



steps of: 

(a) setting various values as each parameter for candidate functions 
and calculating output values corresponding to various input values; 

(b) storing the results of said calculation in storage means; and 

(c) evaluating the resistance of each of said candidate functions to a 
cryptanalysis based on values stored in said storage means, and selectively 
outputting candidate function highly resistant to said cryptanalysis; and 

wherein said step (c) comprising at lease one of: 

(c-1) a higher-order cryptanalysis resistance evaluating step of: 
calculating the minimum value of the degree of a Boolean polynomial for 
input bits of each of said candidate functions by which its output bits are 
expressed; evaluating the resistance of said each candidate function to 
higher order cryptanalysis based on the result of said calculation; and 
leaving those of said candidate functions whose resistance is higher than a 
predetermined first reference and discarding the others; 

(c-2) a differential-linear cryptanalysis resistance evaluating step of: 
calculating, for every set of input difference Ax and output mask value r y 
of each candidate function S(x), the number of mputs x for which the inner 
product of (S(x)+S(xAx)) and said output mask value ry is 1; evaluating 
the resistance of said function to differential-linear cryptanalysis based on 
the result of said calculation; and leaving those of said candidate functions 
whose resistance is higher than a predetermined second reference and 
discarding the others; 

(c-3) a partitioning-cryptanalysis resistance evaluating step of: 
dividing all inputs of each candidate function and the corresponding outputs 
into input subsets and output subsets; calculating an imbalance of the 
relationship between the subset of an input and the subset of the 
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corresponding output with respect to their average corresponding 
relationship; evaluating the resistance of said each candidate function to said 
partitioning cryptanalysis based on the result of said calculation; and leaving 
those of said candidate functions whose resistance is higher than a 
predetermined third reference and discarding the others; and 

(c-4) an interpolation-cryptanalysis resistance evaluating step of: 
when fixing a key y and letting x denote the input of said each candidate, 
expressing an output y by y = fk(x) using a polynonual over Galois field 
which is composed of elements equal to a prime p or a power of said prime 
p; calculatmg the number of terms of said polynomial; evaluating the 
resistance of said function to interpolation cryptanalysis; and leaving those 
of said candidate functions whose resistance is higher than a predetermined 
fourth reference and discarding the others. 

21. The recording medium of claim 20, wherein: 

said differential-linear-cryptanalysis resistance evaluating step (c-2) 
includes a step of: letting the output mask value be represented by ry, 
calculating the following equation for every set of said input difference Ax 
except 0 and said output mask value r y except 0 

(Ax, r>;) = |2x#{jc e GF(2y \(S(x) + S(x + Ax))*Ty = l}-2"\; 

calculating the maximum value S among the calculation results; and 
evaluating the resistance of said candidate function to said differential-linear 
cryptanalysis based on said value E ; and 

said partitioningOcryptanalysis resistance evaluating step (3) includes 
a step of dividing an input set F and an output set G of said function into u 
input subsets {Fq, F^, ... , py.^} and v output subsets {Gq, G^, ... , G^.J; for 
each partition-pan: (Fj, G;) (i = 0, ... , u-1; j = 0, 1, ... , v-1), calculating the 
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maximum one of probabilities that all outputs y corresponding to all inputs x 
of the input subset belong to the respective output subsets Gj (j = 0, ... , v- 
1); calculating a measure Is(F, G) of an average imbalance of a partition-pair 
(F, G) based on all maximum values calculated for all partition pairs; and 
evaluating the resistance of said candidate function to said partitioning 
cryptanalysis based on said measure. 

22. The recording medium of claim 20 or 21, wherein: 

said step (c-1) includes a step of: when no candidate function 
remains undiscarded, easing the candidate function selecting condition by 
changing said first reference by a first predetermined width, and executing 
again the evaluation and selecting process; 

said step (c-2) includes a step of: when no candidate function 
remains undiscarded, easing the candidate function selecting condition by 
changing said second reference by a second predetermined width, and 
executing again the evaluation and selecting process; 

said step (c-3) includes a step of: when no candidate function 
remains undiscarded, easing the candidate function selecting condition by 
changing said third reference by a third predetermined width, and executing 
again the evaluation and selecting process; and 

said step (c-4) includes a step of: when no candidate function 
remains undiscarded, easing the candidate function selecting condition by 
changing said fourth reference by a fourth predetermined width, and 
executing again the evaluation and selecting process. 

23. The recording medium of claim 20 or 21, wherein said program 
includesat least one of: 

(c-5) a differential-cryptanalysis resistance evaluating step of: 
calculating, for each candidate function S(x), the number of inputs x that 
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satisfy S(x)+S(x+S(x+ A x)= A y for every set (Ax, Ay) except Ax; 
evaluating the resistance of said each candidate function to differential 
cryptanalysis based on the result of said calculation; and leaving those of 
said candidate functions whose resistance is higher than a predetermined 
fifth reference and discarding the others; and 

(c-6) a linear-cryptanalysis resistance evaluating step of: calculating, 
for each candidate function, the number of inputs x for which the inner 
product of the input x and its mask value Fx is equal to the inner product of 
a function output value S(x) and its mask value r y; evaluating the 
resistance of said each candidate function to linear cryptanalysis based on 
the result of said calculation; and leaving those of said candidate functions 
whose resistance is higher than a predetermined sixth reference and 
discarding the others. 

24. The recording medium of claim 23, wherein: 

said differential-cryptanalysis resistance evaluating step (c-5) 
includes a step of: calculating the following equation 

6, {Ax, Ay) =#{xGGF(2y |S(x) + S(x + Ax) = Ay} 
for every set of difference values (Ax, Ay) except ry=0; and evaluating 
the resistance of said each candidate function to said differential 
cryptanalysis based on a criterion defined by the following equation 

A^ =vmxSs{A)c,Ay); and 

said linear-cryptanalysis resistance evaluating step (c-6) includes a 
step of: calculating the following equation 

(Fx, Ty) = |2x# e (2)" \x»Tx = S{x) • Ty} - 2" | 

for every set of mask values (Fx, r y); and evaluating the resistance of said 
each candidate function to said linear cryptanalysis based on a criterion 
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defined by the following equation 
A5 = max Ks (Fx, Ty ) . 

25. The recording medium of claim 23 or 24, wherein: 

said step (c-5) includes a step of: when no candidate function 
remains undiscarded, easing the candidate function selecting condition by 
changing said fifth reference by a fifth predetermined width, and executing 
again the evaluation and selecting process; and 

said step (c-6) includes a step of: when no candidate function 
remains undiscarded, easing the candidate function selecting condition by 
changing said sixth reference by a sixth predetermined width, and executing 
again the evaluation and selecting process. 

26. The recording medium of claim 20, 21, or 22, wherein said 
candidate functions are each a composite function composed of at least one 
function resistant to said differential cryptanalysis and said linear 
cryptanalysis and at least one function of an algebraic structure different 
from that of said at least one function. 

27. A recording medium having recorded thereon as a program a 
method for evaluating the randomness of the input/output relationship of a 
function, said program comprising at least one of: 

(a) a higher-order-differential cryptanalysis resistance evaluating 
step of: letting said function be represented by S(x), calculating the 
minimum value of the degree of a Boolean polynomial for input bits of said 
function S(x) by which its output bits are expressed; and evaluating the 
resistance of said function to higher order cryptanalysis based on the result 
of said calculation; 

(b) a differential-linear cryptanalysis resistance evaluating step of: 
calculating, for every set of input difference Ax and output mask value Ty 
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of a function S(x) to be evaluated, the number of inputs x for which the 
inner product of (S(x)+S(x A x)) and said output mask value ry is 1; and 
evaluating the resistance of said function to differential-linear cryptanalysis 
based on the result of said calculation; 

(c) a partitioning-cryptanalysis resistance evaluating step of: dividing 
all inputs of a function to be evaluated and the corresponding outputs into 
input subsets and output subsets; calculating an imbalance of the 
relationship between the subset of an input and the subset of the 
corresponding output with respect to their average corresponding 
relationship; and evaluating the resistance of said function to partitioning 
cryptanalysis based on the result of said calculation; and 

(d) an interpolation-cryptanalysis resistance evaluating step of: when 
fixing a key y and letting x denote the input of said each candidate, 
expressing an output y by y = 4(x) using a polynomial over Galois field 
which is composed of elements equal to a prime p or a power of said prime 
p; calculating the number of terms of said polynomial; and evaluating the 
resistance of said function to interpolation cryptanalysis. 

28. The recording medium of claim 27, wherein: 

said differential-linear cryptanalysis resistance evaluating step (b) is 
a step of:, letting the input difference and output mask value of said function 
S(x) be representing by Ax and ry, respectively, calculating the following 
equation for every set of said input difference Ax except 0 and said output 
mask value r y except 0 

(Ax, Ty) = |2x#{jc eGF(2)" |(5(x) + S(x + Ax)Ty = l}-2''\; 

calculating the maximum value H among the calculation results; and 
evaluating the resistance of said function to said differential-linear 
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cryptanalysis using said value S ; and 

said partitioning-cryptanalysis resistance evaluating step (c) is a step 
of: dividing an input set F and an output set G of said function into u input 
subsets {Fo, Fj, pu-i} and v output subsets {Gq, G^, ... , G^.i}; for each 
partition-pair (Fj, G^) (i = 0, ... , u-1; j = 0, 1, ... , v-1), calculating the 
maximum one of probabilities that all outputs y corresponding to all inputs x 
of the input subset Fj belong to the respective output subsets Gj (j = 0, ... , v- 
1); calculating a measure Is(F, G) of an average imbalance of a partition-pair 
(F, G) based on all maximum values calculated for all partition pairs; and 
evaluating the resistance of said function to said partitioning cryptanalysis 
based on said measure. 

29. The recording medium of claim 27 or 28, said program further 
comprising at least one of: 

(e) a differential-cryptanalysis resistance evaluating step of: letting 
the output difference value of said function S(x) be represented by Ax, 
calculating the number of inputs x that satisfy S(x)+S(x+S(x+ Ax)= Ay for 
every set (Ax, Ay) except Ax=0; and evaluating the resistance of said 
function to differential cryptanalysis based on the result of said calculation; 
and 

(f) a linear-cryptanalysis resistance evaluating means for calculating, 
for said function S(x), the number of inputs x for which the inner product of 
the input x and its mask value r x is equal to the inner product of a function 
output value S(x) and its mask value r y and evaluating the resistance of 
said function to linear cryptanalysis based on the result of said calculation. 

30. The recording medium of claim 29, wherein, letting the number 
of bits of said input x be represented by n: 

said differential-cryptanalysis resistance evaluating step (e) is a step 
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of: calculating the following equation 

ds (Ax, Ay) =#{xeGF(2y \S{x) + S(x + Ax) = Ay} 
for every set of difference values (Ax, Ay) except Ax=0; and evaluating 
the resistance of said function to said differential cryptanalysis based on a 
criterion defined by the following equation 

A5 = max(5j(Ajc,A_y); and 

said linear-cryptanalysis resistance evaluating step (f) is a step of: 
letting the mask value of said input x be represented by r x, calculating the 
following equation 

A5 (rx, r>;) = |2x# ^ e (2)" |jc • rx = s{x) • ry} - 2" | 

for every set of mask values ( r x, r y) except r y=0; and evaluating the 
resistance of said function to said linear cryptanalysis based on a criterion 
defined by the following equation 
A5 = maxA_y(rx,ry). 
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ABSTRACT 

In the evaluation of the randomness of an S-box, measures of 
resistance to higher order cryptanalysis, interpolation cryptanalysis, 
partitioning cryptanalysis and differential-linear cryptanalysis and necessary 
conditions for those measures to have resistance to each cryptanalysis are set, 
then for functions as candidates for the S-box, it is evaluated whether one or 
all of the conditions are satisfied, and those of the candidate functions for 
which one or all of the conditions are satisfied are selected as required. It 
is also possible to further evaluate the resistance of such selected functions 
to at least one of differential cryptanalysis and linear cryptanalysis and 
select those of the candidate functions which are resistant to at least one of 
the cryptanalyses as required. 
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